chore(deps): update rust crate opentelemetry_sdk to 0.32 [security] - autoclosed#1161
Closed
renovate[bot] wants to merge 1 commit into
Closed
chore(deps): update rust crate opentelemetry_sdk to 0.32 [security] - autoclosed#1161renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
1d4-web | d778601 | Commit Preview URL Branch Preview URL |
Jul 04 2026, 07:43 PM |
renovate
Bot
force-pushed
the
renovate/crate-opentelemetry_sdk-vulnerability
branch
3 times, most recently
from
f6b05c5 to
c60166e
Compare
renovate
Bot
force-pushed
the
renovate/crate-opentelemetry_sdk-vulnerability
branch
from
c60166e to
d778601
Compare
aaylward
added a commit
that referenced
this pull request
Jul 4, 2026
…1166) * build(deps): batch Renovate dashboard updates across all ecosystems Batches the pending updates from the Renovate dependency dashboard (#116) and its two open security PRs into one change. Rust (closes the #1161 security PR properly): - opentelemetry / opentelemetry_sdk / opentelemetry-otlp 0.31 -> 0.32 in lockstep (sdk 0.32.1 fixes CVE-2026-48504; renovate's sdk-only bump would have produced two api versions in the graph) - cargo update: semver-compatible refresh of the whole lockfile - verified locally: cargo check --workspace passes npm / 1d4_web (closes the #1160 security PR): - package-lock refresh; vite 8.0.7 -> 8.1.3 (includes the 8.0.16 security fixes for CVE-2026-53571 and CVE-2026-53632) - verified locally: vitest 68/68 pass Go: - lib/pq v1.11.2 -> v1.12.3, prometheus/common v0.67.5 -> v0.69.0, google.golang.org/grpc v1.79.3 -> v1.82.0 (+ tidy) - verified locally: go build ./... and go test ./... match main Bazel modules: - rules_cc 0.2.21, check 0.15.2.bcr.2, opentelemetry-cpp 1.27.0, curl 8.12.0.bcr.1, rules_go 0.61.1, gazelle 0.51.3, contrib_rules_jvm 0.33.0, rules_oci 2.3.0, rules_rust + rules_rust_prost 0.71.3, toolchains_llvm 1.8.0, bazel_features 1.50.0, aspect_rules_lint 2.7.2 - .bazelversion 9.1.0 -> 9.1.1 (also forces a full CI build+test, which validates every bump above) GitHub Actions / infra: - actions/checkout v6 -> v7, bazel-contrib/setup-bazel 0.18.0 -> 0.19.0 - release-wordchains-ios runners macos-15 -> macos-26 - o11y images: prometheus v3.13.0, otel-collector-contrib 0.155.0, cadvisor v0.60.3 Deliberately excluded: maven artifact bumps (maven_install.json repin not runnable in this environment), rules_jvm_external 7 and rules_python 2 (majors), cargo majors (rmcp 2, rustyline 18, tokenizers 0.23, safetensors 0.8, candle 0.11, tower-http 0.7), mongoose 7.22 (needs new archive sha), java_base 26 / ubuntu 26.04 / image digest updates, scalafmt. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Jw99o89a2UYe9NKLE9zGUx * build(deps): revert toolchains_llvm to 1.7.0 toolchains_llvm 1.8.0 changes how -stdlib=libc++ is passed to compile commands, and boringssl's -Werror turns the resulting -Wunused-command-line-argument warning into a hard error: clang: error: argument unused during compilation: '-stdlib=libc++' [-Werror,-Wunused-command-line-argument] Keep 1.7.0 in this batch; the 1.8.0 upgrade needs its own PR with toolchain flag configuration. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Jw99o89a2UYe9NKLE9zGUx --------- Co-authored-by: Claude <noreply@anthropic.com>
renovate
Bot
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
0.31→0.32opentelemetry_sdk has unbounded memory allocation in W3C Baggage propagation
CVE-2026-48504 / GHSA-w9wp-h8wv-79jx
More information
Details
Summary
BaggagePropagator::extract_with_contextinopentelemetry_sdkdid not enforce the W3C Baggage size limits before parsing an inboundbaggageheader. A large attacker-controlled header could cause unnecessary CPU work and short-lived heap allocations while parsing entries that would later be discarded by the SDK's baggage storage limits.The SDK now applies limits aligned with the W3C Baggage limits:
Impact
Services that accept untrusted inbound propagation headers may experience increased per-request resource usage when processing oversized
baggageheaders. This can contribute to denial-of-service risk, especially when application or transport-level header limits are absent or configured above the W3C Baggage limits.The impact is limited to availability. This issue does not expose telemetry data, modify telemetry data, or allow code execution.
Patches
Upgrade
opentelemetry_sdkto version0.32.1or later.Version
0.32.1rejectsbaggageheader values larger than 8192 bytes and limits extraction to the first 64 list-members.Workarounds
If upgrading immediately is not possible, reject or limit inbound
baggageheaders larger than 8192 bytes before invoking OpenTelemetry propagation extraction. This can be enforced at a proxy, gateway, middleware layer, or custom carrier boundary.Resources
Credit
tonghuaroot
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.